> For the complete documentation index, see [llms.txt](https://docs.konvu.com/konvu/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.konvu.com/konvu/administration/account-management/set-up-entra-id-saml-as-an-identity-provider.md).

# Set up Entra ID (SAML) as an Identity Provider

This guide shows you how to connect Entra ID (former Azure Active Directory) as a SAML identity provider in Konvu.

## Set up Entra ID (SAML) as an Identity Provider

This guide covers connecting Entra ID to Konvu over **SAML 2.0**. If you'd rather use OIDC, see [Set up Entra ID (OIDC) as an Identity Provider](/konvu/administration/account-management/set-up-entra-id-as-an-identity-provider.md) instead – you only need one of the two.

You need access to an Entra ID Tenant. If you do not yet have one, follow [this guide from Microsoft](https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-create-new-tenant) to create one for free.

{% hint style="info" %}
SAML setup is a two-way exchange. You configure the enterprise application on the Entra ID side and send Konvu your federation metadata URL. The Konvu team registers the service provider in Zitadel and sends you back the URLs you need to complete the Entra ID configuration.
{% endhint %}

#### Register the enterprise application <a href="#register-the-enterprise-application" id="register-the-enterprise-application"></a>

1. Browse to the [Enterprise applications gallery](https://entra.microsoft.com/#view/Microsoft_AAD_IAM/AppGalleryBladeV2) in the Microsoft Entra admin center.
2. Search for "SAML Toolkit" and select **Microsoft Entra SAML Toolkit**.
3. Rename the application ("Konvu") and click **Create**.

#### Disable the assignment requirement <a href="#disable-the-assignment-requirement" id="disable-the-assignment-requirement"></a>

By default, only explicitly assigned users can sign in. Disable this so any user in your tenant can authenticate, or leave it on and assign users individually.

1. Go to **Manage > Properties**.
2. Set **Assignment required?** to **No**.
3. Save your changes.

<figure><img src="https://4216786002-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fd2uS6kuROSFKDrT5HC1U%2Fuploads%2Fo54OSvV0Dn05igoZw4Sl%2Fimage.png?alt=media&amp;token=df66b194-bf1a-4e39-be1f-34ed83114b8c" alt=""><figcaption></figcaption></figure>

#### Set up SAML single sign-on <a href="#set-up-saml-single-sign-on" id="set-up-saml-single-sign-on"></a>

1. Go to **Manage > Single sign-on** and select **SAML** as the sign-on method.
2. In the **SAML Certificates** section, copy the **App Federation Metadata Url**.

<figure><img src="https://4216786002-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fd2uS6kuROSFKDrT5HC1U%2Fuploads%2FJ23ycZqXQv1mn8N74kia%2Fimage.png?alt=media&amp;token=ae5a7bc5-81b9-476d-aa66-4513db852b5e" alt=""><figcaption></figcaption></figure>

#### Send the metadata URL to Konvu <a href="#send-the-metadata-url-to-konvu" id="send-the-metadata-url-to-konvu"></a>

Send the **App Federation Metadata Url** to the Konvu team. We register the service provider in Zitadel and send you back the values you need for the next step:

<table><thead><tr><th width="238">Entra ID field</th><th>Konvu provides</th></tr></thead><tbody><tr><td>Identifier (Entity ID)</td><td>Konvu SAML metadata URL</td></tr><tr><td>Reply URL (ACS URL)</td><td>Konvu Assertion Consumer Service (ACS) URL</td></tr><tr><td>Sign on URL</td><td>Konvu ACS URL (same value as the Reply URL)</td></tr><tr><td>Logout URL</td><td>Konvu Single Logout (SLO) URL</td></tr></tbody></table>

#### Complete the Basic SAML Configuration <a href="#complete-the-basic-saml-configuration" id="complete-the-basic-saml-configuration"></a>

Back in **Single sign-on**, edit the **Basic SAML Configuration** and fill in the values Konvu sent you:

1. **Identifier (Entity ID)** -- the Konvu SAML metadata URL.
2. **Reply URL (Assertion Consumer Service URL)** -- the Konvu ACS URL.
3. **Sign on URL** -- the same Konvu ACS URL.
4. **Logout URL** -- the Konvu Single Logout URL.
5. Save the configuration.

<figure><img src="https://4216786002-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fd2uS6kuROSFKDrT5HC1U%2Fuploads%2FU3W9XddO5lGfOQzjqCAr%2Fimage.png?alt=media&amp;token=2a01b6bc-6e45-4647-9797-6e9834b576c7" alt=""><figcaption></figcaption></figure>

#### Hand off to Konvu <a href="#hand-off-to-konvu" id="hand-off-to-konvu"></a>

Let the Konvu team know once the Basic SAML Configuration is saved. We activate the provider on your Zitadel organization and enable external login.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.konvu.com/konvu/administration/account-management/set-up-entra-id-saml-as-an-identity-provider.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.